fix(order): enforce versioned platform commands and submissions

scripts/admin-test-env-modules/order-inbound-status-fixtures-contract.test.mjs

@@ -4,6 +4,20 @@ import fs from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
+import { transition } from './order-inbound-status-fixtures.mjs'
+
+test('dynamic Platform cancellation freezes version and key while reject body stays unchanged',async()=>{
+  const calls=[]
+  const context={marker:'fixture',token:'admin',apiSuccess(_m,_n,r){assert.equal(r.body.code,'200');return r.body.data},
+    async request(method,path,body,token,headers){calls.push({method,path,body,token,headers});return {http:200,body:{code:'200',data:{order:{version:9}}}}}}
+  await transition(context,'merchant',{tenantId:'2'},'1','CANCELLED','cancel')
+  const command=calls.find(row=>row.method==='POST')
+  assert.equal(command.token,'admin');assert.equal(command.body.expectedVersion,9);assert.ok(command.headers['Idempotency-Key'])
+  calls.length=0
+  await transition(context,'merchant',{tenantId:'2'},'1','REJECTED','reject')
+  assert.equal(calls.length,1);assert.deepEqual(calls[0].body,{reason:'fixture 保留 REJECTED 人工样本'})
+})
+
 const here = path.dirname(fileURLToPath(import.meta.url))
 const source = fs.readFileSync(path.join(here, 'order-inbound-status-fixtures.mjs'), 'utf8')